postgres-protocol Crate: Unbounded SCRAM Iteration Count Vulnerability
- Severity
- HIGH
- Affected component
- postgres-protocol (cargo)
- Affected versions
- >= 0.3.0, < 0.6.12 or < 0.6.12 or >= 0.3.0, < 0.6.12 or >= 0.0.0-0, < 0.6.12
- Patched version
- Not yet available
An early warning has been issued for a vulnerability in the postgres-protocol crate that allows a malicious server to cause CPU-exhaustion denial of service by supplying an arbitrarily large SCRAM-SHA-256 PBKDF2 iteration count during authentication. This affects clients connecting to untrusted or user-supplied servers.
What happened
An early warning has been issued for a vulnerability in the postgres-protocol crate. This vulnerability allows a malicious server to cause CPU-exhaustion denial of service by supplying an arbitrarily large SCRAM-SHA-256 PBKDF2 iteration count during authentication. The affected versions are >= 0.3.0, < 0.6.12 or < 0.6.12 or >= 0.3.0, < 0.6.12 or >= 0.0.0-0, < 0.6.12. The vulnerability was first flagged on 2026-08-24T19:43:31+00:00.
The vulnerability has not been exploited in the wild as of the latest reports. It is under investigation and the primary sources should be consulted for the most current information.
What to do about it
- Upgrade to a version of postgres-protocol crate with a fixed iteration count upper bound.
- Implement a mitigation strategy to limit the impact of untrusted servers.
- Monitor the primary sources for updates on the vulnerability and any official fixes.
How 0Day would have caught this
postgres-protocol is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
You are affected if you are using postgres-protocol crate versions >= 0.3.0, < 0.6.12 or < 0.6.12 or >= 0.3.0, < 0.6.12 or >= 0.0.0-0, < 0.6.12.
What should I do right now?
Upgrade to a version of postgres-protocol crate with a fixed iteration count upper bound or implement a mitigation strategy to limit the impact of untrusted servers.
Has this been exploited in the wild?
No, the vulnerability has not been exploited in the wild as of the latest reports.